CVE-2024-5751

Executive Summary

CVE-2024-5751 is a critical remote code execution (RCE) vulnerability in BerriAI/litellm version v1.35.8. The flaw resides in the add_deployment function, which decodes and decrypts environment variables from base64 and assigns them to os.environ. An attacker can send a malicious payload to the /config/update endpoint, which is then processed and executed when the get_secret function is triggered. This requires the server to use Google KMS and a database to store a model. The vulnerability has a CVSS score of 9.8, indicating a critical severity. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the PyPI package litellm. Organizations using this package should immediately assess their exposure and consider isolating affected instances until a patch is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) - Complete disclosure of all data on the system.
• Integrity (I): High (H) - Complete compromise of system integrity.
• Availability (A): High (H) - Total shutdown of the affected resource.

Threat Level: Critical. The combination of network exploitability, low complexity, and no required privileges makes this a high-priority threat.

Deep Dive & Mechanics

The vulnerability is triggered through the /config/update endpoint. The add_deployment function processes environment variables that are base64-encoded and potentially encrypted. When the server uses Google KMS and a database to store a model, the get_secret function is invoked. An attacker can craft a malicious payload that, when decoded and decrypted, injects arbitrary commands into the environment variables. These commands are then executed by the server, leading to remote code execution.

The attack flow:

1. Attacker sends a POST request to /config/update with a malicious payload.
2. The add_deployment function decodes the base64-encoded environment variables.
3. If the server uses Google KMS, the variables are decrypted.
4. The decoded/decrypted values are assigned to os.environ.
5. When get_secret is triggered, the malicious environment variable is processed, leading to command execution.

Vulnerable vs. Patched Code

Vulnerable Code (v1.35.8):

def add_deployment(self, config):
    # ... other code ...
    for key, value in config.get('environment_variables', {}).items():
        decoded_value = base64.b64decode(value).decode('utf-8')
        if self.use_kms:
            decoded_value = self.kms_decrypt(decoded_value)
        os.environ[key] = decoded_value
    # ... other code ...

Patched Code (Hypothetical):

def add_deployment(self, config):
    # ... other code ...
    for key, value in config.get('environment_variables', {}).items():
        decoded_value = base64.b64decode(value).decode('utf-8')
        if self.use_kms:
            decoded_value = self.kms_decrypt(decoded_value)
        # Sanitize the value to prevent command injection
        if not is_safe_environment_value(decoded_value):
            raise ValueError("Unsafe environment variable value")
        os.environ[key] = decoded_value
    # ... other code ...

The patched code would include input validation and sanitization to prevent malicious values from being assigned to environment variables.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A litellm server running v1.35.8 with Google KMS and a database configured.
• Network access to the /config/update endpoint.

Exploitation Steps:

1. Craft a malicious payload that, when decoded and decrypted, sets an environment variable to a command injection string.
2. Send a POST request to /config/update with the payload.
3. Trigger the get_secret function to execute the injected command.

Example Payload:

import base64
import requests

# Malicious command to execute
command = "echo 'pwned' > /tmp/pwned.txt"
# Base64 encode the command
encoded_command = base64.b64encode(command.encode()).decode()

# Payload for the /config/update endpoint
payload = {
    "environment_variables": {
        "MALICIOUS_VAR": encoded_command
    }
}

# Send the request
response = requests.post("http://target:8000/config/update", json=payload)
print(response.text)

Blue Team

Detection Steps:

1. Monitor for unusual POST requests to /config/update with large or suspicious payloads.
2. Check for unexpected environment variables being set.
3. Look for command execution events in system logs.

Hunting Query:

SELECT * FROM process_events WHERE command LIKE '%pwned%' OR command LIKE '%/tmp/%';

Indicators of Compromise (IOCs)

• Network: POST requests to /config/update with base64-encoded payloads.
• File: /tmp/pwned.txt or other unexpected files in /tmp/.
• Process: Unexpected shell commands executed by the litellm process.
• Environment: Unusual environment variables set by the litellm process.

Detection Engineering

YARA Rule

rule CVE_2024_5751_RCE {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-5751"
        author = "Valters IT"
        date = "2024-01-01"
    strings:
        $base64_pattern = /[A-Za-z0-9+\/=]{20,}/ 
        $kms_decrypt = "kms_decrypt"
        $os_environ = "os.environ"
    condition:
        $kms_decrypt and $os_environ and #base64_pattern > 0
}

Sigma Rule

title: CVE-2024-5751 RCE Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-5751
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/litellm'
        CommandLine|contains: 'pwned'
    condition: selection
falsepositives:
    - Unknown
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5751 RCE Attempt"; flow:to_server; content:"POST"; http_method; content:"/config/update"; http_uri; content:"environment_variables"; http_client_body; pcre:"/[A-Za-z0-9+\/=]{20,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected litellm instances from the network.
2. Disable the /config/update endpoint if not required.
3. Review and restrict access to the Google KMS key.

Long-term Fix:

• Apply the official patch once released by BerriAI.
• Implement input validation and sanitization for environment variables.
• Use a Web Application Firewall (WAF) to block malicious payloads.

Workaround:

• If patching is not possible, disable the use of Google KMS and database storage for models.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert